Read the docs
TI-2019-13625 Aliases CVE-2019-18901GHSA-xhr6-cwm7-hfr4

mysql-systemd-helper allows setting 640 permissions of arbitrary files

Priority LOW 25CWE-59Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

A UNIX Symbolic Link (Symlink) Following vulnerability in the mysql-systemd-helper of the mariadb packaging of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allows local attackers to change the permissions of arbitrary files to 0640. This issue affects: SUSE Linux Enterprise Server 12 mariadb versions prior to 10.2.31-3.25.1. SUSE Linux Enterprise Server 15 mariadb versions prior to 10.2.31-3.26.1.

Why it matters now

EPSS 0.0038 32nd percentileScored 2026-11-07
Fix Fixed SUSE Linux Enterprise Server 12 (SUSE): 10.2.31-3.25.1SUSE Linux Enterprise Server 15 (SUSE): 10.2.31-3.26.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SUSESUSE Linux Enterprise Server 12mariadb to before 10.2.31-3.25.110.2.31-3.25.1Patch availableCNA
SUSESUSE Linux Enterprise Server 15mariadb to before 10.2.31-3.26.110.2.31-3.26.1Patch availableCNA
  • SUSE Linux Enterprise Server 12 VendorSUSE Affected mariadb to before 10.2.31-3.25.1 Fixed in 10.2.31-3.25.1 Patch available CNA
  • SUSE Linux Enterprise Server 15 VendorSUSE Affected mariadb to before 10.2.31-3.26.1 Fixed in 10.2.31-3.26.1 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*15.1VulnerableopenSUSE
cpe:2.3:o:suse:linux_enterprise_server:12:*:*:*:*:*:*:*12VulnerableSUSE
cpe:2.3:o:suse:linux_enterprise_server:15:*:*:*:*:*:*:*15VulnerableSUSE
  • cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
  • cpe:2.3:o:suse:linux_enterprise_server:12:*:*:*:*:*:*:* Versions 12 Vulnerable ·SUSE
  • cpe:2.3:o:suse:linux_enterprise_server:15:*:*:*:*:*:*:* Versions 15 Vulnerable ·SUSE

Remediation

  • Fix · CNA SUSE Linux Enterprise Server 12 (SUSE) Fixed in 10.2.31-3.25.1
  • Fix · CNA SUSE Linux Enterprise Server 15 (SUSE) Fixed in 10.2.31-3.26.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-18901
  2. 2026-10-03 Alias added: GHSA-xhr6-cwm7-hfr4

References

Advisory 2

  • TI-2016-02888 Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77… KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-02923 Access control flaw in ProFTPD mod_copy allows arbitrary file access KEVCVSS 3.1CRITICAL 10.0
  • TI-2015-02278 Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
  • TI-2013-02212 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java… KEVCVSS 3.1CRITICAL 9.8
See all 475 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences